Electronic commerce, such as, ordering books or reserving tickets, is generally performed in daily life by transmitting a request from a portable terminal through the Internet. In electronic commerce, a goods order is transmitted to a virtual store, more specifically, to a server connected to the Internet. Then, goods, such as tickets, are mailed to an orderer or to a store, such as a convenience store. In the case of a store, an orderer needs to visit a store to obtain the tickets.
Electronic commerce is performed through a communication network, such as the Internet, which any number of people can communicate, therefore, a sender (E.g. a user) and a receiver (E.g. a server) must be identified to prevent impersonation. To this end, a two-way authentication system utilizing a public key encryption system is known. In an authentication process, a sender transmits a public key to a certificate authority. Then, a certificate authority generates an encrypted public key by encrypting a public key with a secret key of a certificate authority, and returns to a sender, a certificate including an encrypted public key. A receiver also obtains a certificate from the certificate authority.
Then, a sender and a receiver exchange a certificate with each other over the Internet before transmitting money data or personal data and the like, and decrypt the exchanged certificate by utilizing a public key of the certificate authority to perform two-way authentication. That is to say, two-way authentication in electronic commerce is performed by exchanging a certificate over the Internet.
When two-way authentication is performed successfully, electronic commerce can be performed. Then, a receiver transmits goods to a sender, and collects money from a sender when electronic commerce is performed successfully.
On the other hand, electronic commerce is also performed without two-way authentication. For example, electronic commerce utilizing a service terminal installed at store, such as a convenience store is well-known. In this case, a service terminal is connected to a communication network; and functions as a kind of a vending machine. When a user operates a service terminal and inserts coins equivalent to services, such information is notified to a server through a communication network; and services, such as issue of concert tickets, and download of game software are performed under control of a server. Then, a user is able to obtain concert tickets, game software and the like from a service terminal.
So far, two modes of electronic commerce have been described, but while each have their advantages, they each also have their disadvantages.
In the first example of electronic commerce, transmission and reception of information is performed through a communication network; thus, a user is able to obtain goods without using actual money (coins). However, a portable telephone itself has no function to issue tickets or the like, and a user is therefore only able to obtain goods by mail and the like. Accordingly, a user must wait for a period of time to obtain goods.
In the second example of electronic commerce, a user has only to visit a store to obtain desired goods, as the goods are issued or provided from a service terminal directly. However, in this electronic commerce, neither two-way authentication between a user and a server, and nor transmission and reception of money data is performed. Accordingly, a user is not able to obtain goods without paying money.
In electronic commerce, the means such as, two-way authentication through a communication network, and transmission and reception of money information, are not utilized, because it is difficult to protect a user and receiver (a goods provider) by the above means. That is to say, a user feels insecurity in inputting authentication information, money information and the like into a service terminal which is not authenticated; and a receiver also feels insecurity in providing goods by relying on authentication information, money information and the like provided by a service terminal user who is not identified.